Built-in server assumes static content if there's a "." in the URL

[asmecher]

Description

1. Use the built-in server
2. Place a phpinfo() script with the following code in a file called index.php in the server's root:

<?php phpinfo();

3. Try requesting a URL with PATH_INFO data:
   http://localhost:8081/anything/works/here
   You should see a valid phpinfo page with the anything/works/here provided as path info data, and the index.php wrapper appropriately identified as the handling script:
   
4. Now, edit the URL to add a ., e.g.:
   http://localhost:8081/anything/works/he.re
   Loading this will give a 404 page:
   

URLs with a . in the PATH_INFO data should work equally well as those without.

The documentation does not mention this quirk:

...but the code appears to look specifically for a .:

php-src/sapi/cli/php_cli_server.c

Line 1458 in a66c926

if (*q-- == '.') {

PHP Version

PHP 8.2.12

Operating System

Ubuntu 20.04

[damianwadley]

The documentation does not mention this quirk:

Actually it does, though perhaps not obviously so:

If a URI request does not specify a file, then either index.php or index.html in the given directory are returned... Otherwise a 404 response code is returned.

"he.re" specifies a file. It may not exist, but it is (presumed to be) a file - yes, because of the period.

Keep in mind that the goal of the built-in server is to quickly emulate a simple web server so that you don't have to run your own Apache/nginx/whatever with all the installation and configuration that entails. The server won't emulate (for example) the Apache copypasta as seen in the linked issue

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^(.*)$ index.php/$ [QSA,L]
</IfModule>

which sends requests for all non-existent things to index.php. If you need that kind of setup then you need to replicate that in a router script - which I, for one, always have regardless.

(side note: I don't know if that trailing $ is intentional, but the RewriteRule is somewhat naive and could be written more simply as RewriteRule ^ index.php [L])

That said, I agree it is currently counter-intuitive behavior and should be changed: it's a half-baked implementation of the "URL rewriting for non-existent things which typically goes to a nearby index.php" pattern that virtually everyone uses. The server should either (a) not make any presumptions at all, and thus necessitate a router script that simulates a .htaccess or other server configuration, or (b) remove this directory/file "detection" and distinction when deciding what to do with the request.

[Amunak]

"he.re" specifies a file. It may not exist, but it is (presumed to be) a file - yes, because of the period.

That's not how URIs work, though. Sure, file.ext might be a file, but it might not be, just like file can be a file, a directory, or it might just not exist. But RFC 3986 does not define which identifiers should be expected to be a file.

It should be trivial to check for the file on filesystem - after all that check then has to be done anyway.

While having full rewrites is probably out of scope for the feature, I don't see why it has to be this primitive. Really all it needs to do is pass everything onto the user's script who can then decide what to do with the URL and what happens when a file doesn't exist.

At the very least this quirk should be documented, though IMO it'd be preferable to just remove this check.

[iluuu1994]

I think the primary motivation might have been to avoid triggering index.php for non-existent asset files that are most likely not served by PHP, e.g. image/CSS/JS files. The default routing does make some assumptions, it's supposed to be "good enough" for the general development case. I do agree that this is inconsistent, and given that it is exclusively used for development it may be beneficial for routing to be more permissive.

This does mean that the server likely accepts more URLs than intended. A production webserver should likely routing in a more precise manner.